Refactoring on Action - having RuleWithAction and RuleWithActionsProperties

src/Makefile.am

@@ -288,6 +288,7 @@ libmodsecurity_la_SOURCES = \
 	rules.cc \
 	rule_unconditional.cc \
 	rule_with_actions.cc \
+	rule_with_actions_properties.cc \
 	rule_with_operator.cc \
 	rule_message.cc \
 	rule_script.cc \

src/actions/action_with_run_time_string.h

@@ -43,14 +43,14 @@ class ActionWithRunTimeString : public virtual Action {
         return *this;
     }
 
-    virtual void populate(RuleWithActions *rule) {
+    virtual void populate(const RuleWithActions *rule) {
         if (m_string) {
             m_string->populate(rule);
         }
     }
 
     std::string getEvaluatedRunTimeString(const Transaction *transaction) const noexcept {
-        return (m_string == nullptr)?"":m_string->evaluate(transaction);
+        return (!m_string)?"":m_string->evaluate(transaction);
     }
 
     bool hasRunTimeString() const noexcept {

src/actions/audit_log.h

@@ -36,7 +36,7 @@ class AuditLog : public ActionTypeRuleMetaData,
     { }
 
     void configure(RuleWithActions *rule) override {
-        rule->setHasAuditLogAction(true);
+        rule->setAuditLog(true);
     }
 };
 

src/actions/block.h

@@ -37,7 +37,7 @@ class Block : public ActionTypeRuleMetaData,
     { }
 
     void configure(RuleWithActions *rule) override {
-        rule->setHasBlockAction(true);
+        rule->setBlock(true);
     }
 };
 

src/actions/capture.h

@@ -33,7 +33,7 @@ class Capture : public ActionTypeRuleMetaData {
         : Action("capture") { }
 
     void configure(RuleWithActions *rule) override {
-        rule->setHasCaptureAction(true);
+        rule->setHasCapture(true);
     }
 };
 

src/actions/log.h

@@ -37,7 +37,7 @@ class Log : public ActionTypeRuleMetaData,
     { }
 
     void configure(RuleWithActions *rule) override {
-        rule->setHasLogAction(true);
+        rule->setLog(true);
     }
 
 };

src/actions/multi_match.h

@@ -34,7 +34,7 @@ class MultiMatch : public ActionTypeRuleMetaData {
 
 
     void configure(RuleWithActions *rule) override {
-        rule->setHasMultimatchAction(true);
+        rule->setMultiMatch(true);
     }
 };
 

src/actions/no_audit_log.h

@@ -36,7 +36,7 @@ class NoAuditLog : public ActionTypeRuleMetaData,
     { }
 
     void configure(RuleWithActions *rule) override {
-        rule->setHasNoAuditLogAction(true);
+        rule->setNoAuditLog(true);
     }
 };
 

src/actions/no_log.h

@@ -36,7 +36,7 @@ class NoLog : public ActionTypeRuleMetaData,
     { }
 
     void configure(RuleWithActions *rule) override {
-        rule->setHasNoLogAction(true);
+        rule->setNoLog(true);
     }
 };
 

src/actions/set_var.h

@@ -87,7 +87,7 @@ class SetVar : public ActionWithRunTimeString, public ActionWithExecution {
 
     bool execute(Transaction *transaction) const noexcept override;
 
-    void populate(RuleWithActions *rule) override {
+    void populate(const RuleWithActions *rule) override {
         ActionWithRunTimeString::populate(rule);
         variables::RuleVariable *rulev =
             dynamic_cast<variables::RuleVariable *>(

src/actions/tag.h

@@ -47,7 +47,7 @@ class Tag : public ActionWithRunTimeString,
 
     bool execute(Transaction *transaction) const noexcept override;
 
-    inline std::string getTagName(Transaction *transaction) const {
+    inline std::string getTagName(const Transaction *transaction) const {
         return getEvaluatedRunTimeString(transaction);
     }
 

src/operators/detect_sqli.cc

@@ -45,7 +45,7 @@ bool DetectSQLi::evaluate(Transaction *transaction,
         ms_dbg_a(transaction, 4, "detected SQLi using libinjection with " \
             "fingerprint '" + std::string(fingerprint) + "' at: '" +
             input.to_string() + "'");
-        if (rule && rule->hasCaptureAction()) {
+        if (rule && rule->hasCapture()) {
             transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
                 "0", std::string(fingerprint));
             ms_dbg_a(transaction, 7, "Added DetectSQLi match TX.0: " + \

src/operators/detect_xss.cc

@@ -37,7 +37,7 @@ bool DetectXSS::evaluate(Transaction *transaction,
     if (transaction) {
         if (is_xss) {
             ms_dbg_a(transaction, 5, "detected XSS using libinjection.");
-            if (rule && rule->hasCaptureAction()) {
+            if (rule && rule->hasCapture()) {
                 transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
                     "0", std::string(input));
                 ms_dbg_a(transaction, 7, "Added DetectXSS match TX.0: " + \

src/operators/pm.cc

@@ -105,7 +105,7 @@ bool Pm::evaluate(Transaction *transaction,
         logOffset(ruleMessage, rc - match_.size() + 1, match_.size());
         transaction->m_matched.push_back(match_);
 
-        if (rule && rule->hasCaptureAction()) {
+        if (rule && rule->hasCapture()) {
             transaction->m_collections.m_tx_collection->storeOrUpdateFirst("0",
                 match_);
             ms_dbg_a(transaction, 7, "Added pm match TX.0: " + \

src/operators/rbl.cc

@@ -229,7 +229,7 @@ bool Rbl::evaluate(Transaction *transaction,
     furtherInfo(sin, str.c_str(), transaction, m_provider);
 
     freeaddrinfo(info);
-    if (rule && transaction && rule->hasCaptureAction()) {
+    if (rule && transaction && rule->hasCapture()) {
         transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
         "0", std::string(str));
         ms_dbg_a(transaction, 7, "Added RXL match TX.0: " + \

src/operators/rx.cc

@@ -58,7 +58,7 @@ bool Rx::evaluate(Transaction *transaction,
     std::vector<Utils::SMatchCapture> captures;
     // FIXME: searchOneMatch should accept string_view.
     re->searchOneMatch(input.c_str(), captures);
-    if (rule && rule->hasCaptureAction() && transaction) {
+    if (rule && rule->hasCapture() && transaction) {
         for (const Utils::SMatchCapture& capture : captures) {
             const std::string capture_substring(input.substr(capture.m_offset,capture.m_length));
             transaction->m_collections.m_tx_collection->storeOrUpdateFirst(

src/operators/rx_global.cc

@@ -54,7 +54,7 @@ bool RxGlobal::evaluate(Transaction *transaction, const RuleWithActions *rule,
     std::vector<Utils::SMatchCapture> captures;
     re->searchGlobal(input.c_str(), captures);
 
-    if (rule && rule->hasCaptureAction() && transaction) {
+    if (rule && rule->hasCapture() && transaction) {
         for (const Utils::SMatchCapture& capture : captures) {
             const std::string capture_substring(input.substr(capture.m_offset,capture.m_length));
             transaction->m_collections.m_tx_collection->storeOrUpdateFirst(

src/operators/verify_cc.cc

@@ -145,7 +145,7 @@ bool VerifyCC::evaluate(Transaction *transaction,
             int is_cc = luhnVerify(match.c_str(), match.size());
             if (is_cc) {
                 if (transaction) {
-                    if (rule && rule->hasCaptureAction()) {
+                    if (rule && rule->hasCapture()) {
                         transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
                             "0", std::string(match));
                         ms_dbg_a(transaction, 7, "Added VerifyCC match TX.0: " + \

src/operators/verify_cpf.cc

@@ -128,7 +128,7 @@ bool VerifyCPF::evaluate(Transaction *transaction,
             is_cpf = verify(m.str().c_str(), m.str().size());
             if (is_cpf) {
                 logOffset(ruleMessage, m.offset(), m.str().size());
-                if (rule && transaction && rule->hasCaptureAction()) {
+                if (rule && transaction && rule->hasCapture()) {
                     transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
                         "0", m.str());
                     ms_dbg_a(transaction, 7, "Added VerifyCPF match TX.0: " + \

src/operators/verify_ssn.cc

@@ -130,7 +130,7 @@ bool VerifySSN::evaluate(Transaction *transaction,
             is_ssn = verify(j.str().c_str(), j.str().size());
             if (is_ssn) {
                 logOffset(ruleMessage, j.offset(), j.str().size());
-                if (rule && transaction && rule->hasCaptureAction()) {
+                if (rule && transaction && rule->hasCapture()) {
                     transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
                         "0", j.str());
                     ms_dbg_a(transaction, 7, "Added VerifySSN match TX.0: " + \

src/operators/verify_svnr.cc

@@ -97,7 +97,7 @@ bool VerifySVNR::evaluate(Transaction *t,
             is_svnr = verify(j.str().c_str(), j.str().size());
             if (is_svnr) {
                 logOffset(ruleMessage, j.offset(), j.str().size());
-                if (rule && t && rule->hasCaptureAction()) {
+                if (rule && t && rule->hasCapture()) {
                     t->m_collections.m_tx_collection->storeOrUpdateFirst(
                         "0", j.str());
                     ms_dbg_a(t, 7, "Added VerifySVNR match TX.0: " + \

src/parser/driver.cc

@@ -109,59 +109,62 @@ int Driver::addSecRule(std::unique_ptr<RuleWithActions> r) {
                     );
                     firstRule->setLogDataAction(nullptr);
                 }
-                if (firstRule->hasSeverityAction()) {
+                if (firstRule->hasSeverity()) {
                     firstRule->getChainedParent()->setSeverity(
                         firstRule->getSeverity()
                     );
                 }
-                if (firstRule->hasRevisionAction()) {
+                if (firstRule->hasRevision()) {
                     firstRule->getChainedParent()->setRevision(
                         firstRule->getRevision()
                     );
                 }
-                if (firstRule->hasVersionAction()) {
+                if (firstRule->hasVersion()) {
                     firstRule->getChainedParent()->setVersion(
                         firstRule->getVersion()
                     );
                 }
-                if (firstRule->hasAccuracyAction()) {
+                if (firstRule->hasAccuracy()) {
                     firstRule->getChainedParent()->setAccuracy(
                         firstRule->getAccuracy()
                     );
                 }
-                if (firstRule->hasMaturityAction()) {
+                if (firstRule->hasMaturity()) {
                     firstRule->getChainedParent()->setMaturity(
                         firstRule->getMaturity()
                     );
                 }
 
-                if (firstRule->hasTagAction()) {
+                if (firstRule->hasTags()) {
                     firstRule->getChainedParent()->setTags(
-                        firstRule->getTagsAction()
+                        firstRule->getTags()
                     );
-                    firstRule->cleanTags();
+                    firstRule->clearTags();
                 }
 
+                /* disruptive can only be set on the first rule
                 if (firstRule->hasDisruptiveAction()) {
                     firstRule->getChainedParent()->setDisruptiveAction(
                         firstRule->getDisruptiveAction()
                     );
                     firstRule->setDisruptiveAction(nullptr);
                 }
-                firstRule->getChainedParent()->setHasBlockAction(
+                */
-                    firstRule->hasBlockAction()
+
+                firstRule->getChainedParent()->setBlock(
+                    firstRule->hasBlock()
                 );
-                firstRule->getChainedParent()->setHasLogAction(
+                firstRule->getChainedParent()->setLog(
-                    firstRule->hasLogAction()
+                    firstRule->hasLog()
                 );
-                firstRule->getChainedParent()->setHasLogAction(
+                firstRule->getChainedParent()->setNoLog(
-                    firstRule->hasNoLogAction()
+                    firstRule->hasNoLog()
                 );
-                firstRule->getChainedParent()->setHasAuditLogAction(
+                firstRule->getChainedParent()->setAuditLog(
-                    firstRule->hasAuditLogAction()
+                    firstRule->hasAuditLog()
                 );
-                firstRule->getChainedParent()->setHasNoAuditLogAction(
+                firstRule->getChainedParent()->setNoAuditLog(
-                    firstRule->hasNoAuditLogAction()
+                    firstRule->hasNoAuditLog()
                 );
                 firstRule = firstRule->getChainedParent();
             }

src/parser/seclang-parser.yy

@@ -1075,7 +1075,7 @@ expression:
     audit_log
     | DIRECTIVE variables op actions
       {
-        std::vector<actions::Action *> *a = new std::vector<actions::Action *>();
+        std::vector<std::shared_ptr<actions::Action>> *a = new std::vector<std::shared_ptr<actions::Action>>();
         std::vector<std::shared_ptr<actions::transformations::Transformation> > *t = new std::vector<std::shared_ptr<actions::transformations::Transformation> >();
         for (auto &i : *$4.get()) {
             if (dynamic_cast<actions::transformations::Transformation *>(i.get())) {
@@ -1083,7 +1083,7 @@ expression:
               std::shared_ptr<actions::transformations::Transformation> t2 = std::dynamic_pointer_cast<actions::transformations::Transformation>(std::move(at));
               t->push_back(std::move(t2));
             } else {
-              a->push_back(i.release());
+              a->push_back(std::move(i));
             }
         }
         variables::Variables *v = new variables::Variables();
@@ -1100,7 +1100,7 @@ expression:
             /* file name */ std::unique_ptr<std::string>(new std::string(*@1.end.filename)),
             /* line number */ @1.end.line
             ));
-
+        // TODO: filename should be a shared_ptr.
         if (driver.addSecRule(std::move(rule)) == false) {
             YYERROR;
         }
@@ -1126,7 +1126,7 @@ expression:
       }
     | CONFIG_DIR_SEC_ACTION actions
       {
-        std::vector<actions::Action *> *a = new std::vector<actions::Action *>();
+        std::vector<std::shared_ptr<actions::Action>> *a = new std::vector<std::shared_ptr<actions::Action>>();
         std::vector<std::shared_ptr<actions::transformations::Transformation> > *t = new std::vector<std::shared_ptr<actions::transformations::Transformation> >();
         for (auto &i : *$2.get()) {
             if (dynamic_cast<actions::transformations::Transformation *>(i.get())) {
@@ -1134,7 +1134,7 @@ expression:
               std::shared_ptr<actions::transformations::Transformation> t2 = std::dynamic_pointer_cast<actions::transformations::Transformation>(std::move(at));
               t->push_back(std::move(t2));
             } else {
-              a->push_back(i.release());
+              a->push_back(std::move(i));
             }
         }
         std::unique_ptr<RuleUnconditional> rule(new RuleUnconditional(
@@ -1148,7 +1148,7 @@ expression:
     | DIRECTIVE_SECRULESCRIPT actions
       {
         std::string err;
-        std::vector<actions::Action *> *a = new std::vector<actions::Action *>();
+        std::vector<std::shared_ptr<actions::Action>> *a = new std::vector<std::shared_ptr<actions::Action>>();
         std::vector<std::shared_ptr<actions::transformations::Transformation> > *t = new std::vector<std::shared_ptr<actions::transformations::Transformation> >();
         for (auto &i : *$2.get()) {
             if (dynamic_cast<actions::transformations::Transformation *>(i.get())) {
@@ -1156,7 +1156,7 @@ expression:
               std::shared_ptr<actions::transformations::Transformation> t2 = std::dynamic_pointer_cast<actions::transformations::Transformation>(std::move(at));
               t->push_back(std::move(t2));
             } else {
-              a->push_back(i.release());
+              a->push_back(std::move(i));
             }
         }
         std::unique_ptr<RuleScript> r(new RuleScript(
@@ -1178,25 +1178,25 @@ expression:
     | CONFIG_DIR_SEC_DEFAULT_ACTION actions
       {
         bool hasDisruptive = false;
-        std::vector<actions::Action *> *actions = new std::vector<actions::Action *>();
+        std::vector<std::shared_ptr<actions::Action>> *actions = new std::vector<std::shared_ptr<actions::Action>>();
         for (auto &i : *$2.get()) {
-            actions->push_back(i.release());
+            actions->push_back(std::move(i));
         }
-        std::vector<actions::Action *> checkedActions;
+        std::vector<std::shared_ptr<actions::Action>> checkedActions;
         int definedPhase = -1;
         int secRuleDefinedPhase = -1;
-        for (actions::Action *a : *actions) {
+        for (auto &a : *actions) {
-            actions::Phase *phase = dynamic_cast<actions::Phase *>(a);
+            actions::Phase *phase = dynamic_cast<actions::Phase *>(a.get());
-            if (dynamic_cast<actions::disruptive::ActionDisruptive *>(a) != NULL
+            if (dynamic_cast<actions::disruptive::ActionDisruptive *>(a.get()) != NULL
-              && dynamic_cast<actions::Block *>(a) == NULL) {
+              && dynamic_cast<actions::Block *>(a.get()) == NULL) {
                 hasDisruptive = true;
             }
             if (phase != NULL) {
                 definedPhase = phase->getPhase();
                 secRuleDefinedPhase = phase->getSecRulePhase();
                 delete phase;
-            } else if (dynamic_cast<actions::ActionAllowedAsSecDefaultAction *>(a)
+            } else if (dynamic_cast<actions::ActionAllowedAsSecDefaultAction *>(a.get())
-              && !dynamic_cast<actions::transformations::None *>(a)) {
+              && !dynamic_cast<actions::transformations::None *>(a.get())) {
                 checkedActions.push_back(a);
             } else {
                 driver.error(@0, "The action '" + *a->getName() + "' is not suitable to be part of the SecDefaultActions");
@@ -1206,12 +1206,10 @@ expression:
         if (definedPhase == -1) {
             definedPhase = modsecurity::Phases::RequestHeadersPhase;
         }
-
         if (hasDisruptive == false) {
             driver.error(@0, "SecDefaultAction must specify a disruptive action.");
             YYERROR;
         }
-
         if (!driver.m_rulesSetPhases[definedPhase]->m_defaultActions.empty()) {
             std::stringstream ss;
             ss << "SecDefaultActions can only be placed once per phase and configuration context. Phase ";
@@ -1220,18 +1218,15 @@ expression:
             driver.error(@0, ss.str());
             YYERROR;
         }
-
+        for (auto &a : checkedActions) {
-        for (actions::Action *a : checkedActions) {
+            if (dynamic_cast<actions::transformations::Transformation *>(a.get())) {
-            if (dynamic_cast<actions::transformations::Transformation *>(a)) {
               driver.m_rulesSetPhases[definedPhase]->m_defaultTransformations.push_back(
-                std::shared_ptr<actions::transformations::Transformation>(
+                std::dynamic_pointer_cast<actions::transformations::Transformation>(a));
-                dynamic_cast<actions::transformations::Transformation *>(a)));
             } else {
-              driver.m_rulesSetPhases[definedPhase]->m_defaultActions.push_back(std::unique_ptr<Action>(a));
+              driver.m_rulesSetPhases[definedPhase]->m_defaultActions.push_back(a);
             }
         }
-
+        //delete actions;
-        delete actions;
       }
     | CONFIG_DIR_SEC_MARKER
       {

src/rule_message.cc

@@ -218,7 +218,7 @@ std::string RuleMessage::getUri() const {
 
 bool RuleMessage::isDisruptive() const {
     if (m_rule) {
-        return m_rule->hasDisruptiveAction();
+        return m_rule->isDisruptive();
     }
     return 0;
 }

src/rule_script.h

@@ -47,7 +47,7 @@ using actions::Action;
 class RuleScript : public RuleWithActions {
  public:
     RuleScript(const std::string &name,
-        std::vector<Action *> *actions,
+        Actions *actions,
         Transformations *t,
         std::unique_ptr<std::string> fileName,
         int lineNumber)

src/rule_unconditional.h

@@ -40,7 +40,7 @@ namespace modsecurity {
 class RuleUnconditional : public RuleWithActions {
  public:
     RuleUnconditional(
-        std::vector<actions::Action *> *actions,
+        Actions *actions,
         Transformations *transformations,
         std::unique_ptr<std::string> fileName,
         int lineNumber)

src/rule_with_actions.cc

@@ -54,140 +54,221 @@
 #include "src/actions/rule_id.h"
 #include "src/actions/ver.h"
 #include "src/actions/action_type_rule_metadata.h"
-
+#include "src/actions/action_allowed_in_sec_default_action.h"
 
 
 namespace modsecurity {
 
+
 RuleWithActions::RuleWithActions(
     Actions *actions,
     Transformations *transformations,
     std::unique_ptr<std::string> fileName,
     int lineNumber)
     : Rule(std::move(fileName), lineNumber),
+    RuleWithActionsProperties(transformations),
     m_ruleId(0),
     m_chainedRuleChild(nullptr),
     m_chainedRuleParent(nullptr),
-    m_disruptiveAction(nullptr),
-    m_logData(nullptr),
-    m_msg(nullptr),
-    m_actionsRuntimePos(),
-    m_actionsSetVar(),
-    m_actionsTag(),
     m_XmlNSs(),
-    m_defaultActionDisruptiveAction(nullptr),
-    m_defaultActionLogData(nullptr),
-    m_defaultActionMsg(nullptr),
-    m_defaultActionActionsRuntimePos(),
-    m_defaultActionActionsSetVar(),
-    m_defaultActionActionsTag(),
-    m_transformations(transformations != nullptr ? *transformations : Transformations()),
-    m_defaultTransformations(),
-    m_severity(SEVERITY_NOT_SET),
-    m_revision(""),
-    m_version(""),
     m_accuracy(ACCURACY_NOT_SET),
     m_maturity(MATURITY_NOT_SET),
-    m_containsCaptureAction(false),
+    m_severity(SEVERITY_NOT_SET),
-    m_containsLogAction(false),
+    m_containsCapture(false),
-    m_containsNoLogAction(false),
+    m_isChained(false),
-    m_containsAuditLogAction(false),
+    m_revision(""),
-    m_containsNoAuditLogAction(false),
+    m_version(""),
-    m_containsMultiMatchAction(false),
+    m_actionMsg(nullptr),
-    m_containsStaticBlockAction(false),
+    m_actionLogData(nullptr),
-    m_defaultSeverity(SEVERITY_NOT_SET),
+    m_defaultActions()
-    m_defaultRevision(""),
+{
-    m_defaultVersion(""),
+    // FIXME: split confs on parser.
-    m_defaultAccuracy(ACCURACY_NOT_SET),
+    std::vector<std::shared_ptr<ActionTypeRuleMetaData>> confs;
-    m_defaultMaturity(MATURITY_NOT_SET),
+    std::vector<std::shared_ptr<Action>> newActions;
-    m_defaultContainsCaptureAction(false),
-    m_defaultContainsLogAction(false),
-    m_defaultContainsNoLogAction(false),
-    m_defaultContainsAuditLogAction(false),
-    m_defaultContainsNoAuditLogAction(false),
-    m_defaultContainsMultiMatchAction(false),
-    m_defaultContainsStaticBlockAction(false),
-    m_isChained(false) {
-
     if (actions) {
-        for (actions::Action *a : *actions) {
+        for (auto &a : *actions) {
-            addAction(a);
+            if (std::dynamic_pointer_cast<ActionTypeRuleMetaData>(a)) {
+                confs.push_back(std::dynamic_pointer_cast<ActionTypeRuleMetaData>(a));
+                continue;
+            } else if (std::dynamic_pointer_cast<ActionDisruptive>(a)) {
+                setDisruptiveAction(std::dynamic_pointer_cast<ActionDisruptive>(a));
+                continue;
+            }
+            newActions.push_back(a);
+        }
+    }
+
+
+    /**
+     *
+     * Those are actions that only fit the propose to update something in
+     * the rule: META-DATA; e.g. RuleID.
+     *
+     * The merge action takes care of those properties. Once configured the
+     * action can be forgotten.
+     *
+     */
+    for (auto &c : confs) {
+        c->configure(this);
+    }
+
+    for (auto &a : newActions) {
+        if (std::dynamic_pointer_cast<actions::SetVar>(a)) {
+            addSetVar(std::dynamic_pointer_cast<actions::SetVar>(a));
+            continue;
+        }
+        if (std::dynamic_pointer_cast<actions::Tag>(a)) {
+            addTag(std::dynamic_pointer_cast<actions::Tag>(a));
+            continue;
+        }
+        if (std::dynamic_pointer_cast<actions::XmlNS>(a)) {
+            m_XmlNSs.push_back(std::dynamic_pointer_cast<actions::XmlNS>(a));
+            continue;
+        }
+        if (std::dynamic_pointer_cast<actions::LogData>(a)) {
+            m_actionLogData = std::dynamic_pointer_cast<actions::LogData>(a);
+            continue;
+        }
+        if (std::dynamic_pointer_cast<actions::Msg>(a)) {
+            m_actionMsg = std::dynamic_pointer_cast<actions::Msg>(a);
+            continue;
+        }
+
+        addGenericMatchAction(std::dynamic_pointer_cast<ActionWithExecution>(a));
+    }
+    populate(this);
+}
+
+
+RuleWithActions::RuleWithActions(const RuleWithActions &r)
+    : Rule(r),
+    RuleWithActionsProperties(r),
+    m_ruleId(r.m_ruleId),
+    m_chainedRuleChild(r.m_chainedRuleChild),
+    m_chainedRuleParent(r.m_chainedRuleParent),
+    m_XmlNSs(/*r.m_XmlNSs*/),
+    m_accuracy(r.m_accuracy),
+    m_maturity(r.m_maturity),
+    m_severity(r.m_severity),
+    m_containsCapture(r.m_containsCapture),
+    m_isChained(r.m_isChained),
+    m_revision(r.m_revision),
+    m_version(r.m_version),
+    m_actionMsg(nullptr /*r.m_actionMsg*/),
+    m_actionLogData(nullptr /* r.m_actionLogData */),
+    m_defaultActions(r.m_defaultActions) {
+        copyActionsWithRunTimeStrings(r);
+        m_defaultActions.populate(this);
+        populate(this);
+}
+
+
+RuleWithActions &RuleWithActions::operator=(const RuleWithActions& r) {
+    Rule::operator = (r);
+    RuleWithActionsProperties::operator = (r);
+    m_ruleId = r.m_ruleId;
+    m_chainedRuleChild = r.m_chainedRuleChild;
+    m_chainedRuleParent = r.m_chainedRuleParent;
+    /*m_XmlNSs = r.m_XmlNSs;*/
+    m_accuracy = r.m_accuracy;
+    m_maturity = r.m_maturity;
+    m_severity = r.m_severity;
+    m_containsCapture = r.m_containsCapture;
+    m_isChained = r.m_isChained;
+    m_revision = r.m_revision;
+    m_version = r.m_version;
+    /*m_actionMsg = r.m_actionMsg;*/
+    /*m_actionLogData = r.m_actionLogData;*/
+    m_defaultActions = r.m_defaultActions;
+    copyActionsWithRunTimeStrings(r);
+    m_defaultActions.populate(this);
+    populate(this);
+    return *this;
+}
+
+
+void inline RuleWithActions::copyActionsWithRunTimeStrings(const RuleWithActions &r) {
+    if (r.m_actionLogData) {
+        actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(r.m_actionLogData.get());
+        if (!arts) {
+            /* Humpf?  */
+            m_actionLogData = r.m_actionLogData;
+        } else {
+            std::shared_ptr<actions::LogData> z(dynamic_cast<actions::LogData *>(arts->clone()));
+            actions::ActionWithRunTimeString *aa = dynamic_cast<actions::ActionWithRunTimeString *>(z.get());
+            aa->populate(nullptr);
+            m_actionLogData = z;
+        }
+    }
+    if (r.m_actionMsg) {
+        actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(r.m_actionMsg.get());
+        if (!arts) {
+            /* Humpf?  */
+            m_actionMsg = r.m_actionMsg;
+        } else {
+            std::shared_ptr<actions::Msg> z(dynamic_cast<actions::Msg *>(arts->clone()));
+            actions::ActionWithRunTimeString *aa = dynamic_cast<actions::ActionWithRunTimeString *>(z.get());
+            aa->populate(nullptr);
+            m_actionMsg = z;
+        }
+    }
+    for (auto &i : r.m_XmlNSs) {
+        actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
+        if (!arts) {
+            /* Humpf?  */
+            m_XmlNSs.push_back(i);
+        } else {
+            std::shared_ptr<actions::XmlNS> z(dynamic_cast<actions::XmlNS *>(arts->clone()));
+            actions::ActionWithRunTimeString *aa = dynamic_cast<actions::ActionWithRunTimeString *>(z.get());
+            aa->populate(nullptr);
+            m_XmlNSs.push_back(z);
         }
     }
 }
 
+
+
 void RuleWithActions::addDefaultAction(std::shared_ptr<actions::Action> a) {
+    actions::ActionAllowedAsSecDefaultAction *d = dynamic_cast<actions::ActionAllowedAsSecDefaultAction *>(a.get());
+    if (d == nullptr) {
+        throw std::runtime_error("Action is being used as DefaultAction but not allowed.");
+    }
 
+    /**
+     *
+     * ActionWithRunTimeString needs to be aware of the Rule that it
+     * belongs to. It is necessary to resolve some variables
+     * (e.g. Rule); Clone and associate are mandatory.
+     *
+     */
     actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(a.get());
     if (arts != nullptr) {
         a = std::unique_ptr<actions::Action>(arts->clone());
         arts = dynamic_cast<actions::ActionWithRunTimeString *>(a.get());
         arts->populate(this);
     }
-
+    if (std::dynamic_pointer_cast<actions::SetVar>(a)) {
-    if (dynamic_cast<ActionTypeRuleMetaData *>(a.get())) {
+        m_defaultActions.addSetVar(std::dynamic_pointer_cast<actions::SetVar>(a));
-        ActionTypeRuleMetaData *conf = dynamic_cast<ActionTypeRuleMetaData *>(a.get());
-        conf->configure(this);
         return;
     }
-
+    if (std::dynamic_pointer_cast<actions::Tag>(a)) {
-    if (dynamic_cast<actions::LogData *>(a.get())) {
+        m_defaultActions.addTag(std::dynamic_pointer_cast<actions::Tag>(a));
-        m_defaultActionLogData.reset(dynamic_cast<actions::LogData *>(a.get()));
-    } else if (dynamic_cast<actions::Msg *>(a.get())) {
-        m_defaultActionMsg.reset(dynamic_cast<actions::Msg *>(a.get()));
-    } else if (dynamic_cast<actions::SetVar *>(a.get())) {
-        actions::SetVar *var = dynamic_cast<actions::SetVar *>(a.get());
-        m_actionsSetVar.push_back(std::unique_ptr<actions::SetVar>(var));
-    } else if (dynamic_cast<actions::Tag *>(a.get())) {
-        m_defaultActionActionsTag.push_back(std::dynamic_pointer_cast<actions::Tag>(a));
-    } else if (dynamic_cast<actions::Block *>(a.get())) {
-        m_defaultActionActionsRuntimePos.push_back(std::dynamic_pointer_cast<ActionWithExecution>(a));
-        m_defaultContainsStaticBlockAction = true;
-    } else if (std::dynamic_pointer_cast<ActionDisruptive>(a) != NULL) {
-        m_defaultActionDisruptiveAction = std::dynamic_pointer_cast<ActionDisruptive>(a);
-    } else {
-        m_defaultActionActionsRuntimePos.push_back(std::dynamic_pointer_cast<ActionWithExecution>(a));
-    }
-}
-
-void RuleWithActions::addAction(actions::Action *a) {
-    actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(a);
-    if (arts != nullptr) {
-        a = arts->clone();
-        arts = dynamic_cast<actions::ActionWithRunTimeString *>(a);
-        arts->populate(this);
-    }
-
-    if (dynamic_cast<ActionTypeRuleMetaData *>(a)) {
-        ActionTypeRuleMetaData *conf = dynamic_cast<ActionTypeRuleMetaData *>(a);
-        conf->configure(this);
-        delete a;
         return;
     }
-
+    if (std::dynamic_pointer_cast<actions::Block>(a)) {
-    if (dynamic_cast<actions::LogData *>(a)) {
+        m_defaultActions.setBlock(true);
-        m_logData = std::unique_ptr<actions::LogData>(dynamic_cast<actions::LogData*>(a));
+        return;
-    } else if (dynamic_cast<actions::Msg *>(a)) {
-        m_msg = std::unique_ptr<actions::Msg>(dynamic_cast<actions::Msg*>(a));
-    } else if (dynamic_cast<actions::SetVar *>(a)) {
-        actions::SetVar *var = dynamic_cast<actions::SetVar *>(a);
-        m_actionsSetVar.push_back(std::unique_ptr<actions::SetVar>(var));
-    } else if (dynamic_cast<actions::Tag *>(a)) {
-        m_actionsTag.push_back(std::unique_ptr<actions::Tag>(dynamic_cast<actions::Tag *>(a)));
-    } else if (dynamic_cast<actions::Block *>(a)) {
-        m_actionsRuntimePos.push_back(std::unique_ptr<ActionWithExecution>(dynamic_cast<ActionWithExecution *>(a)));
-        m_containsStaticBlockAction = true;
-    } else if (dynamic_cast<actions::XmlNS *>(a)) {
-        m_XmlNSs.push_back(std::unique_ptr<actions::XmlNS>(dynamic_cast<actions::XmlNS *>(a)));
-    } else if (dynamic_cast<ActionDisruptive *>(a) != NULL) {
-        m_disruptiveAction = std::unique_ptr<ActionDisruptive>(dynamic_cast<ActionDisruptive *>(a));
-    } else {
-        m_actionsRuntimePos.push_back(std::unique_ptr<ActionWithExecution >(dynamic_cast<ActionWithExecution *>(a)));
     }
+    if (std::dynamic_pointer_cast<ActionDisruptive>(a)) {
+        m_defaultActions.setDisruptiveAction(std::dynamic_pointer_cast<ActionDisruptive>(a));
+        return;
+    }
+    std::shared_ptr<ActionWithExecution> bp = std::dynamic_pointer_cast<ActionWithExecution>(a);
+    if (!bp) {
+        return;
+    }
+    m_defaultActions.addGenericMatchAction(bp);
 }
-
-
-RuleWithActions::~RuleWithActions() { }
 
 
 bool RuleWithActions::evaluate(Transaction *transaction) const {
@@ -199,97 +280,80 @@ bool RuleWithActions::evaluate(Transaction *transaction) const {
 
 
 void RuleWithActions::executeActionsIndependentOfChainedRuleResult(Transaction *trans) const {
-
+    /* setVar */
-    for (actions::SetVar *a : getSetVarsActionsPtr()) {
+    auto f = [](Transaction *t, const std::shared_ptr<actions::SetVar> &var) {
-        ms_dbg_a(trans, 4, "Running [independent] (non-disruptive) " \
+        ms_dbg_a(t, 4, "Running [independent] (non-disruptive) action: " + *var->getName());
-            "action: " + *a->getName());
+        var->execute(t);
-
+    };
-        a->execute(trans);
+    for (auto &a : m_defaultActions.getSetVars()) {  f(trans, a);  }
-    }
+    for (auto &a : getSetVars()) {  f(trans, a);  }
 }
 
 
 void RuleWithActions::executeActionsAfterFullMatch(Transaction *trans) const {
     bool disruptiveAlreadyExecuted = false;
 
-    for (actions::Tag *a : getTagsActionPtr()) {
+    /* tags */
-        ms_dbg_a(trans, 4, "Running (non-disruptive) action: " \
+    auto f = [](Transaction *t, const std::shared_ptr<actions::Tag> &tag) {
-            + a->getTagName(trans));
+        ms_dbg_a(t, 4, "Running (non-disruptive) action: " + tag->getTagName(t));
-        a->execute(trans);
+        tag->execute(t);
-    }
+    };
+    for (auto &a : m_defaultActions.getTags()) {  f(trans, a);  }
+    for (auto &a : getTags()) { f(trans, a);  }
+
 
     /**
-     * 
      * FIXME: SecRuleUpdateActionBy should be runtime
-     * 
      */
     auto range = trans->m_rules->m_exceptions.m_action_pos_update_target_by_id.equal_range(m_ruleId);
     for (auto it = range.first; it != range.second; ++it) {
         ActionWithExecution *a = dynamic_cast<ActionWithExecution*>(it->second.get());
         if (dynamic_cast<ActionDisruptive *>(a)) {
             trans->messageGetLast()->setRule(this);
-        }
-        executeAction(trans, a, false);
-        if (dynamic_cast<ActionDisruptive *>(a)) {
             disruptiveAlreadyExecuted = true;
         }
-    }
+        ms_dbg_a(trans, 9, "Running action placed by updateTargetById: " + *a->getName());
-
-    if (m_logData) {
-        m_logData->execute(trans);
-    } else if (m_defaultActionLogData) {
-        m_defaultActionLogData->execute(trans);
-    }
-
-    if (m_msg) {
-        m_msg->execute(trans);
-    } else if (m_defaultActionMsg) {
-        m_defaultActionMsg->execute(trans);
-    }
-
-    for (auto &a : getMatchActionsPtr()) {
-        if (!dynamic_cast<ActionDisruptive *>(a)
-                && !(disruptiveAlreadyExecuted
-                && dynamic_cast<actions::Block *>(a))) {
-            executeAction(trans, a, false);
-        }
-    }
-    if (!disruptiveAlreadyExecuted && m_disruptiveAction != nullptr) {
-        executeAction(trans,
-            m_disruptiveAction.get(), false);
-    } else if  (!disruptiveAlreadyExecuted && hasBlockAction()
-        && m_defaultActionDisruptiveAction != nullptr) {
-        executeAction(trans,
-            m_defaultActionDisruptiveAction.get(), false);
-    }
-}
-
-
-void RuleWithActions::executeAction(Transaction *trans,
-    ActionWithExecution *a, bool defaultContext) {
-    ms_dbg_a(trans, 9, "Running action: " + *a->getName());
         a->execute(trans);
     }
 
+    /* generic actions */
+    auto fg = [](Transaction *t, const std::shared_ptr<ActionWithExecution> &a) {
+        ms_dbg_a(t, 9, "Running action: " + *a->getName());
+        a->execute(t);
+    };
+    for (auto &a : m_defaultActions.getGenericMatchActions()) {  fg(trans, a);  }
+    for (auto &a : getGenericMatchActions()) {  fg(trans, a);  }
 
-void RuleWithActions::executeAction(Transaction *trans,
+    if (m_actionLogData) {
-    ActionDisruptive *a, bool defaultContext) const {
+        m_actionLogData->execute(trans);
-    if (defaultContext && !hasBlockAction()) {
+    }
-        ms_dbg_a(trans, 4, "Ignoring action: " + *a->getName() + \
+
-            " (rule does not cotains block)");
+    if (m_actionMsg) {
+        m_actionMsg->execute(trans);
+    }
+
+    /* disruptive actions */
+    if (disruptiveAlreadyExecuted) {
+        return;
+    }
+    auto fd = [](Transaction *t, const std::shared_ptr<ActionDisruptive> &a) {
+        if (t->getRuleEngineState() == RulesSet::EnabledRuleEngine) {
+            ms_dbg_a(t, 4, "Running (disruptive)     action: " + *a->getName() + ".");
+            const ActionWithExecution *ae = dynamic_cast<const ActionWithExecution *>(a.get());
+            ae->execute(t);
             return;
         }
 
-    if (trans->getRuleEngineState() == RulesSet::EnabledRuleEngine) {
+        ms_dbg_a(t, 4, "Not running disruptive action: " \
-        ms_dbg_a(trans, 4, "Running (disruptive)     action: " + \
-            *a->getName() + ".");
-        ActionWithExecution *ae = dynamic_cast<ActionWithExecution *>(a);
-        ae->execute(trans);
-        return;
-    }
-
-    ms_dbg_a(trans, 4, "Not running disruptive action: " \
             + *a->getName() + ". SecRuleEngine is not On.");
+    };
+    if (hasDisruptiveAction()) {
+        trans->messageGetLast()->setRule(this);
+        fd(trans, getDisruptiveAction());
+    } else if ((hasBlock() || m_defaultActions.hasBlock()) && m_defaultActions.hasDisruptiveAction()) {
+        trans->messageGetLast()->setRule(this);
+        fd(trans, m_defaultActions.getDisruptiveAction());
+    }
 }
 
 
@@ -303,26 +367,17 @@ void RuleWithActions::executeTransformations(
     ssin.assign(in.c_str(), in.size());
     results.push_back(TransformationResult(&ssin));
 
-
+    //FIXME: none should be pre-computed.
-    std::string path("");
+    for (auto &action : m_defaultActions.getTransformations()) {
-    std::shared_ptr<std::string> value =
+        if (dynamic_cast<actions::transformations::None *>(action.get())) {
-        std::shared_ptr<std::string>(new std::string(in));
-
-    for (Transformation *action : getTransformationPtr()) {
-        if (dynamic_cast<actions::transformations::None *>(action)) {
             none++;
         }
     }
-
+    for (auto &action : getTransformations()) {
-    for (Transformation *t : getTransformationPtr()) {
+        if (dynamic_cast<actions::transformations::None *>(action.get())) {
-        if (none == 0) {
+            none++;
-            executeTransformation(trans, &results, t);
-        }
-        if (dynamic_cast<actions::transformations::None *>(t)) {
-            none--;
         }
     }
-
     // FIXME: It can't be something different from transformation. Sort this
     //        on rules compile time.
     auto range = trans->m_rules->m_exceptions.m_action_transformation_update_target_by_id.equal_range(m_ruleId);
@@ -333,6 +388,24 @@ void RuleWithActions::executeTransformations(
         }
     }
 
+    for (auto &t : m_defaultActions.getTransformations()) {
+        if (none == 0) {
+            executeTransformation(trans, &results, t.get());
+        }
+        if (dynamic_cast<actions::transformations::None *>(t.get())) {
+            none--;
+        }
+    }
+
+    for (auto &t : getTransformations()) {
+        if (none == 0) {
+            executeTransformation(trans, &results, t.get());
+        }
+        if (dynamic_cast<actions::transformations::None *>(t.get())) {
+            none--;
+        }
+    }
+
     for (auto it = range.first; it != range.second; ++it) {
         Transformation *t = it->second.get();
         if (none == 0) {
@@ -381,9 +454,14 @@ void RuleWithActions::executeTransformation(
 }
 
 
-bool RuleWithActions::containsTag(const std::string& name, Transaction *t) const {
+bool RuleWithActions::containsTag(const std::string& name, const Transaction *t) const noexcept {
-    for (auto &tag : getTagsAction()) {
+    for (auto &tag : m_defaultActions.getTags()) {
-        if (tag != NULL && tag->getTagName(t) == name) {
+        if (tag != nullptr && tag->getTagName(t) == name) {
+            return true;
+        }
+    }
+    for (auto &tag : getTags()) {
+        if (tag != nullptr && tag->getTagName(t) == name) {
             return true;
         }
     }
@@ -391,13 +469,18 @@ bool RuleWithActions::containsTag(const std::string& name, Transaction *t) const
 }
 
 
-bool RuleWithActions::containsMsg(const std::string& name, Transaction *t) const {
+bool RuleWithActions::containsMsg(const std::string& name, const Transaction *t) const noexcept {
-    return m_msg && m_msg->getEvaluatedRunTimeString(t) == name;
+    return m_actionMsg && m_actionMsg->getEvaluatedRunTimeString(t) == name;
 }
 
 
-std::string RuleWithActions::getLogData(const Transaction *t) const { return m_logData->getEvaluatedRunTimeString(t); }
+std::string RuleWithActions::getLogData(const Transaction *t) const noexcept {
-std::string RuleWithActions::getMessage(const Transaction *t) const { return m_msg->getEvaluatedRunTimeString(t); }
+    return m_actionLogData->getEvaluatedRunTimeString(t);
+}
 
 
+std::string RuleWithActions::getMessage(const Transaction *t) const noexcept {
+    return m_actionMsg->getEvaluatedRunTimeString(t);
+}
+
 }  // namespace modsecurity

src/rule_with_actions.h

@@ -25,19 +25,32 @@
 #ifndef SRC_RULE_WITH_ACTIONS_H_
 #define SRC_RULE_WITH_ACTIONS_H_
 
-#include "modsecurity/transaction.h"
-#include "modsecurity/modsecurity.h"
-#include "modsecurity/variable_value.h"
-#include "modsecurity/rule.h"
 #include "modsecurity/actions/action.h"
+#include "modsecurity/modsecurity.h"
+#include "modsecurity/rule.h"
+#include "modsecurity/rule_message.h"
+#include "modsecurity/rules_set.h"
+#include "modsecurity/transaction.h"
+#include "modsecurity/variable_value.h"
+#include "src/actions/action_allowed_in_sec_default_action.h"
 #include "src/actions/action_type_rule_metadata.h"
 #include "src/actions/action_with_execution.h"
+#include "src/actions/action_with_run_time_string.h"
 #include "src/actions/disruptive/disruptive_action.h"
-
+#include "src/actions/transformations/transformation.h"
+#include "src/actions/xmlns.h"
+#include "src/rule_with_actions.h"
+#include "src/rule_with_actions_properties.h"
+#include "src/utils/string.h"
+#include "src/transformation_result.h"
 
 #ifdef __cplusplus
 
+
 namespace modsecurity {
+    using XmlNSs = std::vector<std::shared_ptr<actions::XmlNS> >;
+    using XmlNSsPtr = std::vector<actions::XmlNS *>;
+
 
 namespace actions {
 class Action;
@@ -45,200 +58,42 @@ class Severity;
 class LogData;
 class Msg;
 class Rev;
-class SetVar;
-class Tag;
 class XmlNS;
 namespace transformations {
 class Transformation;
 }
 }
 
-using Transformation = actions::transformations::Transformation;
-using Transformations = std::vector<std::shared_ptr<Transformation> >;
-using TransformationsPtr = std::vector<Transformation *>;
 
-using Actions = std::vector<actions::Action *>;
+class RuleWithActions : public Rule, public RuleWithActionsProperties {
-using ActionWithExecution = actions::ActionWithExecution;
+ public:
+
+    using Action = actions::Action;
+    using Actions = std::vector<std::shared_ptr<Action>>;
     using ActionTypeRuleMetaData = actions::ActionTypeRuleMetaData;
-using ActionDisruptive = actions::disruptive::ActionDisruptive;
 
-using MatchActions = std::vector<std::shared_ptr<ActionWithExecution > >;
+    const unsigned int SEVERITY_NOT_SET = 10;
-using MatchActionsPtr = std::vector<ActionWithExecution *>;
+    const unsigned int ACCURACY_NOT_SET = 10;
-
+    const unsigned int MATURITY_NOT_SET = 10;
-using Tags = std::vector<std::shared_ptr<actions::Tag> >;
-using TagsPtr = std::vector<actions::Tag *>;
-
-using SetVars = std::vector<std::shared_ptr<actions::SetVar> >;
-using SetVarsPtr = std::vector<actions::SetVar *>;
-
-using XmlNSs = std::vector<std::shared_ptr<actions::XmlNS> >;
-using XmlNSsPtr = std::vector<actions::XmlNS *>;
-
-
-class TransformationResult {
- public:
-    explicit TransformationResult(
-        ModSecString &after,
-        const std::string *transformation = nullptr)
-        : m_after(after),
-        m_transformation(transformation) { };
-
-    explicit TransformationResult(
-        ModSecString *after)
-        : m_after(*after),
-        m_transformation(nullptr) { };
-
-    TransformationResult(const TransformationResult &t2)
-        : m_after(t2.m_after),
-        m_transformation(t2.m_transformation) { };
-
-
-    ModSecString *getAfter() {
-        return &m_after;
-    }
-
-
-    const std::string *getTransformationName() const {
-        return m_transformation;
-    }
-
-
- private:
-    ModSecString m_after;
-    const std::string *m_transformation;
-};
-
-using TransformationsResults = std::list<TransformationResult>;
-
-
-class RuleWithActions : public Rule {
- public:
-    int SEVERITY_NOT_SET = 10;
-    int ACCURACY_NOT_SET = 10;
-    int MATURITY_NOT_SET = 10;
 
     RuleWithActions(
         Actions *a,
         Transformations *t,
         std::unique_ptr<std::string> fileName,
         int lineNumber);
-    ~RuleWithActions();
-
-    RuleWithActions(const RuleWithActions &r)
-        : Rule(r),
-        m_ruleId(r.m_ruleId),
-        m_chainedRuleChild(r.m_chainedRuleChild),
-        m_chainedRuleParent(r.m_chainedRuleParent),
-        m_disruptiveAction(r.m_disruptiveAction),
-        m_logData(r.m_logData),
-        m_msg(r.m_msg),
-        m_actionsRuntimePos(r.m_actionsRuntimePos),
-        m_actionsSetVar(r.m_actionsSetVar),
-        m_actionsTag(r.m_actionsTag),
-        m_XmlNSs(r.m_XmlNSs),
-        m_defaultActionDisruptiveAction(r.m_defaultActionDisruptiveAction),
-        m_defaultActionLogData(r.m_defaultActionLogData),
-        m_defaultActionMsg(r.m_defaultActionMsg),
-        m_defaultActionActionsRuntimePos(r.m_defaultActionActionsRuntimePos),
-        m_defaultActionActionsSetVar(r.m_defaultActionActionsSetVar),
-        m_defaultActionActionsTag(r.m_defaultActionActionsTag),
-        m_transformations(r.m_transformations),
-        m_defaultTransformations(r.m_defaultTransformations),
-        m_severity(r.m_severity),
-        m_revision(r.m_revision),
-        m_version(r.m_version),
-        m_accuracy(r.m_accuracy),
-        m_maturity(r.m_maturity),
-        m_containsCaptureAction(r.m_containsCaptureAction),
-        m_containsLogAction(r.m_containsLogAction),
-        m_containsNoLogAction(r.m_containsNoLogAction),
-        m_containsAuditLogAction(r.m_containsAuditLogAction),
-        m_containsNoAuditLogAction(r.m_containsNoAuditLogAction),
-        m_containsMultiMatchAction(r.m_containsMultiMatchAction),
-        m_containsStaticBlockAction(r.m_containsStaticBlockAction),
-        m_defaultSeverity(r.m_defaultSeverity),
-        m_defaultRevision(r.m_defaultRevision),
-        m_defaultVersion(r.m_defaultVersion),
-        m_defaultAccuracy(r.m_defaultAccuracy),
-        m_defaultMaturity(r.m_defaultMaturity),
-        m_defaultContainsCaptureAction(r.m_defaultContainsCaptureAction),
-        m_defaultContainsLogAction(r.m_defaultContainsLogAction),
-        m_defaultContainsNoLogAction(r.m_defaultContainsNoLogAction),
-        m_defaultContainsAuditLogAction(r.m_defaultContainsAuditLogAction),
-        m_defaultContainsNoAuditLogAction(r.m_defaultContainsNoAuditLogAction),
-        m_defaultContainsMultiMatchAction(r.m_defaultContainsMultiMatchAction),
-        m_defaultContainsStaticBlockAction(r.m_defaultContainsStaticBlockAction),
-        m_isChained(r.m_isChained) {
-            // TODO: Verify if it is necessary to process any other copy.
-        };
-
-    RuleWithActions &operator=(const RuleWithActions& r) {
-        Rule::operator = (r);
-        m_ruleId = r.m_ruleId;
-        m_chainedRuleChild = r.m_chainedRuleChild;
-        m_chainedRuleParent = r.m_chainedRuleParent;
-        m_disruptiveAction = r.m_disruptiveAction;
-        m_logData = r.m_logData;
-        m_msg = r.m_msg;
-        m_actionsRuntimePos = r.m_actionsRuntimePos;
-        m_actionsSetVar = r.m_actionsSetVar;
-        m_actionsTag = r.m_actionsTag;
-        m_XmlNSs = r.m_XmlNSs;
-        m_defaultActionDisruptiveAction = r.m_defaultActionDisruptiveAction;
-        m_defaultActionLogData = r.m_defaultActionLogData;
-        m_defaultActionMsg = r.m_defaultActionMsg;
-        m_defaultActionActionsRuntimePos = r.m_defaultActionActionsRuntimePos;
-        m_defaultActionActionsSetVar = r.m_defaultActionActionsSetVar;
-        m_defaultActionActionsTag = r.m_defaultActionActionsTag;
-        m_transformations = r.m_transformations;
-        m_defaultTransformations = r.m_defaultTransformations;
-        m_severity = r.m_severity;
-        m_revision = r.m_revision;
-        m_version = r.m_version;
-        m_accuracy = r.m_accuracy;
-        m_maturity = r.m_maturity;
-        m_containsCaptureAction = r.m_containsCaptureAction;
-        m_containsLogAction = r.m_containsLogAction;
-        m_containsNoLogAction = r.m_containsNoLogAction;
-        m_containsAuditLogAction = r.m_containsAuditLogAction;
-        m_containsNoAuditLogAction = r.m_containsNoAuditLogAction;
-        m_containsMultiMatchAction = r.m_containsMultiMatchAction;
-        m_containsStaticBlockAction = r.m_containsStaticBlockAction;
-        m_defaultSeverity = r.m_defaultSeverity;
-        m_defaultRevision = r.m_defaultRevision;
-        m_defaultVersion = r.m_defaultVersion;
-        m_defaultAccuracy = r.m_defaultAccuracy;
-        m_defaultMaturity = r.m_defaultMaturity;
-        m_defaultContainsCaptureAction = r.m_defaultContainsCaptureAction;
-        m_defaultContainsLogAction = r.m_defaultContainsLogAction;
-        m_defaultContainsNoLogAction = r.m_defaultContainsNoLogAction;
-        m_defaultContainsAuditLogAction = r.m_defaultContainsAuditLogAction;
-        m_defaultContainsNoAuditLogAction = r.m_defaultContainsNoAuditLogAction;
-        m_defaultContainsMultiMatchAction = r.m_defaultContainsMultiMatchAction;
-        m_defaultContainsStaticBlockAction = r.m_defaultContainsStaticBlockAction;
-        m_isChained = r.m_isChained;
-        return *this;
-        // TODO: Verify if it is necessary to process any other copy.
-    }
 
+    RuleWithActions(const RuleWithActions &r);
+    RuleWithActions &operator=(const RuleWithActions& r);
 
     virtual bool evaluate(Transaction *transaction) const override;
 
-
     void executeActionsIndependentOfChainedRuleResult(
-        Transaction *trasn) const;
+        Transaction *trasaction) const;
 
     void executeActionsAfterFullMatch(
-        Transaction *trasn) const;
+        Transaction *transaction) const;
-
-    static void executeAction(Transaction *trans,
-        ActionWithExecution *a,
-        bool context);
-
-    void executeAction(Transaction *trans,
-        ActionDisruptive *a,
-        bool context) const;
 
+    // FIXME: Pass a callback for the transformation execution.
     static void executeTransformation(
         Transaction *transaction,
         TransformationsResults *ret,
@@ -255,253 +110,187 @@ class RuleWithActions : public Rule {
         const std::string &value,
         TransformationsResults &results) const;
 
-    void addAction(actions::Action *a);
+    /* */
-    void addTransformation(std::shared_ptr<actions::transformations::Transformation> t) {
+    bool containsTag(const std::string& name, const Transaction *t) const noexcept;
-        m_transformations.push_back(t);
+    bool containsMsg(const std::string& name, const Transaction *t) const noexcept;
-    }
-    void addDefaultAction(std::shared_ptr<actions::Action>);
-    void addDefaultTransformation(std::shared_ptr<actions::transformations::Transformation> t) {
-        m_defaultTransformations.push_back(t);
-    }
-
-
-    std::vector<actions::Action *> getActionsByName(const std::string& name,
-        Transaction *t);
-    bool containsTag(const std::string& name, Transaction *t) const;
-    bool containsMsg(const std::string& name, Transaction *t) const;
 
 
+    /* default Actions */
     void clearDefaultActions() {
-        m_defaultSeverity = SEVERITY_NOT_SET;
+        m_defaultActions.clear();
-        m_defaultRevision = "";
+    }
-        m_defaultVersion = "";
+    void addDefaultAction(std::shared_ptr<actions::Action> a);
-        m_defaultAccuracy = ACCURACY_NOT_SET;
+    void addDefaulTransformation(std::shared_ptr<Transformation> t) {
-        m_defaultMaturity = MATURITY_NOT_SET;
+        m_defaultActions.addTransformation(t);
-        m_defaultContainsCaptureAction = false;
-        m_defaultContainsLogAction = false;
-        m_defaultContainsNoLogAction = false;
-        m_defaultContainsMultiMatchAction = false;
-        m_defaultContainsStaticBlockAction = false;
-        m_defaultActionLogData = nullptr;
-        m_defaultActionMsg = nullptr;
-        m_defaultActionActionsSetVar.clear();
-        m_defaultActionActionsTag.clear();
-        m_defaultActionActionsRuntimePos.clear();
-        m_defaultActionDisruptiveAction = nullptr;
-        m_defaultActionActionsRuntimePos.clear();
-        m_defaultTransformations.clear();
     }
 
-    Transformations getTransformation() const {
+
-        Transformations dst;
+    /* rule id */
-        for (auto &a : m_defaultTransformations) {
+    // FIXME: not ever rule has an id. e.g. chained rule. */
-            dst.push_back(a);
+    inline const RuleId getId() const noexcept { return m_ruleId; }
-        }
+    void setId(int id) noexcept {
-        for (auto &a : m_transformations) {
+        m_ruleId = id;
-            dst.push_back(a);
-        }
-        return dst;
     }
 
-    TransformationsPtr getTransformationPtr() const {
+
-        TransformationsPtr dst;
+    /* capture */
-        for (auto &a : m_defaultTransformations) {
+    inline void setHasCapture(bool b) noexcept {
-            dst.push_back(a.get());
+        m_containsCapture = b;
     }
-        for (auto &a : m_transformations) {
+    inline bool hasCapture() const noexcept {
-            dst.push_back(a.get());
+        return m_containsCapture;
-        }
-        return dst;
     }
 
-    SetVars getSetVarsActions() const {
+
-        SetVars dst;
+    /* accuracy */
-        for (auto &a : m_defaultActionActionsSetVar) {
+    inline const int getAccuracy() const noexcept {
-            dst.push_back(a);
+        return m_accuracy;
     }
-        for (auto &a : m_actionsSetVar) {
+    inline void setAccuracy(unsigned int accuracy) noexcept {
-            dst.push_back(a);
+        m_accuracy = accuracy;
     }
-        return dst;
+    inline bool hasAccuracy() const noexcept {
+        return m_accuracy != ACCURACY_NOT_SET;
     }
 
-    SetVarsPtr getSetVarsActionsPtr() const {
+
-        SetVarsPtr dst;
+    /* severity */
-        for (auto &a : m_defaultActionActionsSetVar) {
+    inline int getSeverity() const noexcept {
-            dst.push_back(a.get());
+        return m_severity;
     }
-        for (auto &a : m_actionsSetVar) {
+    inline void setSeverity(unsigned int severity) noexcept {
-            dst.push_back(a.get());
+        m_severity = severity;
     }
-        return dst;
+    inline bool hasSeverity() const noexcept {
+        return m_severity != SEVERITY_NOT_SET;
     }
 
-    MatchActionsPtr getMatchActionsPtr() const {
+
-        MatchActionsPtr dst;
+    /* revision */
-        for (auto &a : m_defaultActionActionsRuntimePos) {
+    inline const std::string getRevision() const noexcept {
-            dst.push_back(a.get());
+        return m_revision;
+    };
+    inline void setRevision(const std::string &revision) noexcept {
+        m_revision.assign(revision);
     }
-        for (auto &a : m_actionsRuntimePos) {
+    inline bool hasRevision() const noexcept {
-            dst.push_back(a.get());
+        return m_revision != "";
-        }
-        return dst;
     }
 
-    MatchActions getMatchActions() const {
+
-        MatchActions dst;
+    /* version */
-        for (auto &a : m_defaultActionActionsRuntimePos) {
+    inline const std::string getVersion() const noexcept {
-            dst.push_back(a);
+        return m_version;
+    };
+    inline void setVersion(const std::string &version) noexcept {
+        m_version.assign(version);
     }
-        for (auto &a : m_actionsRuntimePos) {
+    inline bool hasVersion() const noexcept {
-            dst.push_back(a);
+        return m_version != "";
-        }
-        return dst;
     }
 
+
+    /* maturity */
+    inline const int getMaturity() const noexcept {
+        return m_maturity;
+    }
+    inline void setMaturity(unsigned int maturity) noexcept {
+        m_maturity = maturity;
+    }
+    inline bool hasMaturity() const noexcept {
+        return m_maturity != MATURITY_NOT_SET;
+    }
+
+
+    /* logData */
+    inline std::shared_ptr<actions::LogData> getLogDataAction() const noexcept {
+        return m_actionLogData;
+    }
+    std::string getLogData(const Transaction *t) const noexcept;
+    inline void setLogDataAction(const std::shared_ptr<actions::LogData> &data) noexcept {
+        m_actionLogData = data;
+    }
+    inline bool hasLogDataAction() const noexcept {
+        return m_actionLogData != nullptr;
+    }
+
+
+    /* message */
+    inline std::shared_ptr<actions::Msg> getMessageAction() const noexcept {
+        return m_actionMsg;
+    }
+    std::string getMessage(const Transaction *t) const noexcept;
+    inline void setMessageAction(const std::shared_ptr<actions::Msg> &msg) noexcept {
+        m_actionMsg = msg;
+    }
+    inline bool hasMessageAction() const noexcept {
+        return m_actionMsg != nullptr;
+    }
+
+
+    /* multimatch */
+    inline bool processMultiMatch() const noexcept {
+        return hasMultiMatch() || m_defaultActions.hasMultiMatch();
+    }
+
+
+    /* isDisruptive */
+    inline bool isDisruptive() const {
+        return hasDisruptiveAction() || ((m_defaultActions.hasBlock() || hasBlock()) && m_defaultActions.hasBlock());
+    }
+
+
+    /* logging */
+    inline bool isItToBeLogged() const noexcept {
+        if (hasNoLog()) {
+            return false;
+        }
+        if (m_defaultActions.hasNoLog() && !hasNoLog()) {
+            return false;
+        }
+        if (!hasDisruptiveAction() && !(hasBlock() || m_defaultActions.hasBlock())) {
+            return false;
+        }
+        if (!m_defaultActions.hasDisruptiveAction() && !hasDisruptiveAction()) {
+            return false;
+        }
+        return true;
+    }
+
+    inline bool isItToBeAuditLogged() const noexcept {
+        if (hasAuditLog()) {
+            return true;
+        }
+        if (m_defaultActions.hasAuditLog() && !hasNoAuditLog()) {
+            return true;
+        }
+        if (isItToBeLogged()) {
+            return true;
+        }
+        return false;
+    }
+
+
+    /* chained rule */
+    /* FIXME: The chained rule needs to have its own class. */
+    void setChainedNext(std::unique_ptr<RuleWithActions> r) {
+        m_chainedRuleChild = std::move(r);
+    }
+    inline RuleWithActions *getChainedNext() const {
+        return m_chainedRuleChild.get();
+    }
+    void setChainedParent(RuleWithActions *r) {
+        m_chainedRuleParent = r;
+    }
+    inline RuleWithActions *getChainedParent() {
+        return m_chainedRuleParent;
+    }
     inline bool hasChainAction() const { return m_isChained == true; }
     inline void setHasChainAction(bool b) { m_isChained = b; }
     inline bool hasChainedParent() const { return m_chainedRuleParent != nullptr; }
     inline bool hasChainedChild() const { return m_chainedRuleChild.get() != nullptr; }
 
-    inline void setHasCaptureAction(bool b) { m_containsCaptureAction = b; }
-    inline bool hasCaptureAction() const { return m_containsCaptureAction || m_defaultContainsCaptureAction; }
 
-    inline bool hasDisruptiveAction() const { return m_disruptiveAction != nullptr || m_defaultActionDisruptiveAction != nullptr; }
-    inline void setDisruptiveAction(const std::shared_ptr<ActionDisruptive> &a) { m_disruptiveAction = a; }
-    inline std::shared_ptr<ActionDisruptive> getDisruptiveAction() const { return m_disruptiveAction; }
-
-    inline bool hasBlockAction() const { return m_containsStaticBlockAction || m_defaultContainsStaticBlockAction; }
-    inline void setHasBlockAction(bool b) { m_containsStaticBlockAction = b; }
-
-    inline void setHasMultimatchAction(bool b) { m_containsMultiMatchAction = b; }
-    inline bool hasMultimatchAction() const { return m_containsMultiMatchAction || m_defaultContainsMultiMatchAction; }
-
-    inline bool hasAuditLogAction() const { return m_containsAuditLogAction == true; }
-    inline void setHasAuditLogAction(bool b) { m_containsAuditLogAction = b; }
-    inline bool hasNoAuditLogAction() const { return m_containsNoAuditLogAction == true; }
-    inline void setHasNoAuditLogAction(bool b) { m_containsNoAuditLogAction = b; }
-
-    inline bool hasLogAction() const { return m_containsLogAction == true; }
-    inline void setHasLogAction(bool b) { m_containsLogAction = b; }
-    inline bool hasNoLogAction() const { return m_containsNoLogAction == true; }
-    inline void setHasNoLogAction(bool b) { m_containsNoLogAction = b; }
-
-
-    inline bool isItToBeLogged() const noexcept {
-        if (m_containsNoLogAction) {
-            return false;
-        }
-
-        if (m_defaultContainsNoLogAction && !m_containsLogAction) {
-            return false;
-        }
-
-        return true;
-    }
-
-
-    inline bool isItToBeAuditLogged() const noexcept {
-        if (!isItToBeLogged() && !m_containsAuditLogAction
-            && !m_defaultContainsAuditLogAction) {
-            return false;
-        }
-
-        if (m_containsNoAuditLogAction) {
-            return false;
-        }
-
-        if (m_defaultContainsNoLogAction && !m_containsAuditLogAction) {
-            return false;
-        }
-
-        return true;
-    }
-
-
-    inline bool hasLogDataAction() const { return m_logData != nullptr || m_defaultActionLogData != nullptr; }
-    inline std::shared_ptr<actions::LogData> getLogDataAction() const { return m_logData; }
-    std::string getLogData(const Transaction *t) const;
-    inline void setLogDataAction(const std::shared_ptr<actions::LogData> &data) { m_logData = data; }
-
-    inline bool hasMessageAction() const { return m_msg != nullptr || m_defaultActionMsg != nullptr; }
-    inline std::shared_ptr<actions::Msg> getMessageAction() const { return m_msg; }
-    inline void setMessageAction(const std::shared_ptr<actions::Msg> &msg) { m_msg = msg; }
-    std::string getMessage(const Transaction *t) const;
-
-
-    inline bool hasSeverityAction() const { return m_severity != SEVERITY_NOT_SET || m_defaultSeverity != SEVERITY_NOT_SET; }
-    inline int getSeverity() const { return (m_severity != SEVERITY_NOT_SET)?m_severity:m_defaultSeverity; }
-    inline void setDefaultActionSeverity(unsigned int severity) { m_defaultSeverity = severity; }
-    inline void setSeverity(unsigned int severity) { m_severity = severity; }
-
-    inline bool hasRevisionAction() const { return m_revision != ""; }
-    inline const std::string getRevision() const { return m_revision; };
-    inline void setRevision(const std::string &revision) { m_revision.assign(revision); }
-
-    inline bool hasVersionAction() const { return m_version != ""; }
-    inline const std::string getVersion() const { return m_version; };
-    inline void setVersion(const std::string &version) { m_version.assign(version); }
-
-    inline bool hasAccuracyAction() const { return m_accuracy != ACCURACY_NOT_SET || m_defaultAccuracy != ACCURACY_NOT_SET; }
-    inline const int getAccuracy() const { return m_accuracy; }
-    inline void setAccuracy(unsigned int accuracy) { m_accuracy = accuracy; }
-
-    inline bool hasMaturityAction() const { return m_maturity != MATURITY_NOT_SET || m_defaultMaturity != MATURITY_NOT_SET; }
-    inline const int getMaturity() const { return m_maturity; }
-    inline void setDefaultActionMaturity(unsigned int maturity) { m_defaultMaturity = maturity; }
-    inline void setMaturity(unsigned int maturity) { m_maturity = maturity; }
-
-    inline bool hasTagAction() const { return m_actionsTag.size() > 0; }
-    inline void setTags(Tags tags) {
-        for (auto tag : tags) {
-            m_actionsTag.push_back(tag);
-        }
-    }
-    inline void cleanTags() {
-        m_actionsTag.clear();
-    }
-    Tags getTagsAction() const {
-        Tags dst;
-        for (auto &a : m_defaultActionActionsTag) {
-            dst.push_back(a);
-        }
-        for (auto &a : m_actionsTag) {
-            dst.push_back(a);
-        }
-        return dst;
-    }
-
-    TagsPtr getTagsActionPtr() const {
-        TagsPtr dst;
-        for (auto &a : m_defaultActionActionsTag) {
-            dst.push_back(a.get());
-        }
-        for (auto &a : m_actionsTag) {
-            dst.push_back(a.get());
-        }
-        return dst;
-    }
-
-    inline RuleId getId() const { return m_ruleId; }
-    void setId(int id) {
-        m_ruleId = id;
-    }
-
-    void setChainedNext(std::unique_ptr<RuleWithActions> r) {
-        m_chainedRuleChild = std::move(r);
-    }
-
-    inline RuleWithActions *getChainedNext() const {
-        return m_chainedRuleChild.get();
-    }
-
-    void setChainedParent(RuleWithActions *r) {
-        m_chainedRuleParent = r;
-    }
-
-    inline RuleWithActions *getChainedParent() {
-        return m_chainedRuleParent;
-    }
 
     XmlNSs getXmlNSs() const {
         XmlNSs dst;
@@ -530,37 +319,24 @@ class RuleWithActions : public Rule {
     }
 
  private:
+    void inline copyActionsWithRunTimeStrings(const RuleWithActions &o);
+
     RuleId m_ruleId;
 
     std::shared_ptr<RuleWithActions> m_chainedRuleChild;
     RuleWithActions *m_chainedRuleParent;
 
-    /* actions */
+    /* xmlns */
-    std::shared_ptr<ActionDisruptive> m_disruptiveAction;
-    std::shared_ptr<actions::LogData> m_logData;
-    std::shared_ptr<actions::Msg> m_msg;
-    MatchActions m_actionsRuntimePos;
-    SetVars m_actionsSetVar;
-    Tags m_actionsTag;
     XmlNSs m_XmlNSs;
 
-    /* actions || SecDefaultAction */
+    /**
-    std::shared_ptr<ActionDisruptive> m_defaultActionDisruptiveAction;
+     * 1-9 where 9 is very strong and 1 has many false positives
-    std::shared_ptr<actions::LogData> m_defaultActionLogData;
+     */
-    std::shared_ptr<actions::Msg> m_defaultActionMsg;
+    unsigned int m_accuracy:4;
-
+    /**
-    MatchActions m_defaultActionActionsRuntimePos;
+     * 1-9 where 9 is extensively tested and 1 is a brand new experimental rule
-    SetVars m_defaultActionActionsSetVar;
+     */
-    Tags m_defaultActionActionsTag;
+    unsigned int m_maturity:4;
-
-    /* actions > transformations */
-    Transformations m_transformations;
-
-    /* actions > transformations || SecDefaultAction */
-    Transformations m_defaultTransformations;
-
-
-    /* || */
     /**
      * 0 - EMERGENCY: is generated from correlation of anomaly
      *                scoring data where there is an inbound
@@ -581,44 +357,16 @@ class RuleWithActions : public Rule {
      * 6 - INFO
      * 7 - DEBUG
      **/
-    unsigned int m_severity:3;
+    unsigned int m_severity:4;
-
+    bool m_containsCapture:1;
+    bool m_isChained:1;
     std::string m_revision;
     std::string m_version;
+    std::shared_ptr<actions::Msg> m_actionMsg;
+    std::shared_ptr<actions::LogData> m_actionLogData;
 
-    /**
+    /* SecDefaultAction */
-     * 1-9 where 9 is very strong and 1 has many false positives
+    RuleWithActionsProperties m_defaultActions;
-     */
-    unsigned int m_accuracy:3;
-    /**
-     * 1-9 where 9 is extensively tested and 1 is a brand new experimental rule
-     */
-    unsigned int m_maturity:3;
-
-
-    bool m_containsCaptureAction:1;
-    bool m_containsLogAction:1;
-    bool m_containsNoLogAction:1;
-    bool m_containsAuditLogAction:1;
-    bool m_containsNoAuditLogAction:1;
-    bool m_containsMultiMatchAction:1;
-    bool m_containsStaticBlockAction:1;
-
-    /* || SecDefaultAction */
-    unsigned int m_defaultSeverity:3;
-    std::string m_defaultRevision;
-    std::string m_defaultVersion;
-    unsigned int m_defaultAccuracy:3;
-    unsigned int m_defaultMaturity:3;
-    bool m_defaultContainsCaptureAction:1;
-    bool m_defaultContainsLogAction:1;
-    bool m_defaultContainsNoLogAction:1;
-    bool m_defaultContainsAuditLogAction:1;
-    bool m_defaultContainsNoAuditLogAction:1;
-    bool m_defaultContainsMultiMatchAction:1;
-    bool m_defaultContainsStaticBlockAction:1;
-
-    bool m_isChained:1;
 };
 
 }  // namespace modsecurity

src/rule_with_actions_properties.cc

@@ -0,0 +1,150 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include "modsecurity/rule.h"
+
+#include <stdio.h>
+
+#include <algorithm>
+#include <cstring>
+#include <iostream>
+#include <list>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "src/actions/set_var.h"
+#include "src/actions/tag.h"
+#include "src/actions/transformations/transformation.h"
+
+
+namespace modsecurity {
+
+
+RuleWithActionsProperties::RuleWithActionsProperties(Transformations *transformations) :
+    m_hasAuditLog(false),
+    m_hasBlock(false),
+    m_hasLog(false),
+    m_hasMultiMatch(false),
+    m_hasNoAuditLog(false),
+    m_hasNoLog(false),
+    m_executeIfMatchActions(),
+    m_setVars(),
+    m_disruptiveAction(nullptr),
+    m_tags(),
+    m_transformations(transformations != nullptr ? *transformations : Transformations())
+{ }
+
+
+
+RuleWithActionsProperties::RuleWithActionsProperties(const RuleWithActionsProperties &o) :
+    m_hasAuditLog(o.m_hasAuditLog),
+    m_hasBlock(o.m_hasBlock),
+    m_hasLog(o.m_hasLog),
+    m_hasMultiMatch(o.m_hasMultiMatch),
+    m_hasNoAuditLog(o.m_hasNoAuditLog),
+    m_hasNoLog(o.m_hasNoAuditLog),
+    m_executeIfMatchActions(),
+    m_setVars(),
+    m_disruptiveAction(o.m_disruptiveAction),
+    m_tags(),
+    m_transformations(o.m_transformations)
+{
+    copyActionsWithRunTimeStrings(o);
+}
+
+
+RuleWithActionsProperties &RuleWithActionsProperties::operator=(const RuleWithActionsProperties &o) {
+    m_hasAuditLog = o.m_hasAuditLog;
+    m_hasBlock = o.m_hasBlock;
+    m_hasLog = o.m_hasLog;
+    m_hasMultiMatch = o.m_hasMultiMatch;
+    m_hasNoAuditLog = o.m_hasNoAuditLog;
+    m_hasNoLog = o.m_hasNoAuditLog;
+    m_disruptiveAction = o.m_disruptiveAction;
+    m_transformations = o.m_transformations;
+    copyActionsWithRunTimeStrings(o);
+
+    return *this;
+}
+
+
+void inline RuleWithActionsProperties::copyActionsWithRunTimeStrings(const RuleWithActionsProperties &o) {
+    for (auto &i : o.m_executeIfMatchActions) {
+        actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
+        if (!arts) {
+            m_executeIfMatchActions.push_back(i);
+            continue;
+        }
+        std::shared_ptr<actions::ActionWithExecution> z(dynamic_cast<actions::ActionWithExecution *>(arts->clone()));
+        actions::ActionWithRunTimeString *aa = dynamic_cast<actions::ActionWithRunTimeString *>(z.get());
+        aa->populate(nullptr);
+        m_executeIfMatchActions.push_back(z);
+    }
+    for (auto &i : o.m_setVars) {
+        actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
+        if (!arts) {
+            m_setVars.push_back(i);
+            continue;
+        }
+        std::shared_ptr<actions::SetVar> z(dynamic_cast<actions::SetVar *>(arts->clone()));
+        actions::ActionWithRunTimeString *aa = dynamic_cast<actions::ActionWithRunTimeString *>(z.get());
+        aa->populate(nullptr);
+        m_setVars.push_back(z);
+    }
+    for (auto &i : o.m_tags) {
+        actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
+        if (!arts) {
+            m_tags.push_back(i);
+            continue;
+        }
+        std::shared_ptr<actions::Tag> z(dynamic_cast<actions::Tag *>(arts->clone()));
+        actions::Tag *aa = dynamic_cast<actions::Tag *>(z.get());
+        aa->populate(nullptr);
+        m_tags.push_back(z);
+    }
+}
+
+
+void RuleWithActionsProperties::populate(const RuleWithActions *r) const {
+    /**
+     *
+     * ActionWithRunTimeString needs to be aware of the Rule that it
+     * belongs to. It is necessary to resolve some variables
+     * (e.g. Rule); Clone and associate are mandatory.
+     *
+     */
+    for (auto &i : m_executeIfMatchActions) {
+        actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
+        if (arts != nullptr) {
+            arts->populate(r);
+        }
+    }
+    for (auto &i : m_setVars) {
+        actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
+        if (arts != nullptr) {
+            arts->populate(r);
+        }
+    }
+    for (auto &i : m_tags) {
+        actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
+        if (arts != nullptr) {
+            arts->populate(r);
+        }
+    }
+}
+
+
+}  // namespace modsecurity

src/rule_with_actions_properties.h

@@ -0,0 +1,213 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+
+#ifndef SRC_RULE_WITH_ACTIONS_PROPERTIES_H_
+#define SRC_RULE_WITH_ACTIONS_PROPERTIES_H_
+
+
+#include "modsecurity/modsecurity.h"
+#include "src/actions/action_with_execution.h"
+#include "src/actions/disruptive/disruptive_action.h"
+
+namespace modsecurity {
+
+namespace actions {
+class SetVar;
+class Tag;
+namespace transformations {
+class Transformation;
+}
+}
+
+
+class RuleWithActionsProperties {
+    /**
+     * Properties that can be part of the SecDefaultActions.
+     *
+     */
+ public:
+    using ActionWithExecution = actions::ActionWithExecution;
+    using ActionDisruptive = actions::disruptive::ActionDisruptive;
+    using MatchActions = std::vector<std::shared_ptr<ActionWithExecution>>;
+    using SetVar = actions::SetVar;
+    using SetVars = std::vector<std::shared_ptr<SetVar>>;
+    using Tag = actions::Tag;
+    using Tags = std::vector<std::shared_ptr<Tag>>;
+    using Transformation = actions::transformations::Transformation;
+    using Transformations = std::vector<std::shared_ptr<Transformation>>;
+
+    explicit RuleWithActionsProperties(Transformations *transformations = nullptr);
+    ~RuleWithActionsProperties() {
+        /* all the allocated resources are shared pointers. */
+    }
+
+    RuleWithActionsProperties(const RuleWithActionsProperties &o);
+    RuleWithActionsProperties &operator=(const RuleWithActionsProperties &o);
+    RuleWithActionsProperties(RuleWithActionsProperties &&o) = delete;
+
+
+    void clear() {
+        m_hasLog = false;
+        m_hasNoLog = false;
+        m_hasBlock = false;
+        m_setVars.clear();
+        m_tags.clear();
+        m_disruptiveAction = nullptr;
+        m_executeIfMatchActions.clear();
+        m_transformations.clear();
+    };
+
+    void populate(const RuleWithActions *r) const;
+
+
+    /* auditLog */
+    bool hasAuditLog() const noexcept {
+        return m_hasAuditLog;
+    }
+    void setAuditLog(bool b) {
+        m_hasAuditLog = b;
+    }
+
+
+    /* log */
+    bool hasLog() const noexcept {
+        return m_hasLog;
+    }
+    void setLog(bool b) {
+        m_hasLog = b;
+    }
+
+
+    /* MultiMatch */
+    bool hasMultiMatch() const noexcept {
+        return m_hasMultiMatch;
+    }
+    void setMultiMatch(bool b) {
+        m_hasMultiMatch = b;
+    }
+
+
+    /* noAuditLog */
+    bool hasNoAuditLog() const noexcept {
+        return m_hasNoAuditLog;
+    }
+    void setNoAuditLog(bool b) {
+        m_hasNoAuditLog = b;
+    }
+
+
+    /* noLog */
+    bool hasNoLog() const noexcept {
+        return m_hasNoLog;
+    }
+    void setNoLog(bool b) {
+        m_hasNoLog = b;
+    }
+
+
+    /* block */
+    bool hasBlock() const noexcept {
+        return m_hasBlock;
+    }
+    void setBlock(bool b) {
+        m_hasBlock = b;
+    }
+
+
+    /* transformations */
+    const Transformations &getTransformations() const noexcept {
+        return m_transformations;
+    }
+    void addTransformation(std::shared_ptr<Transformation> t) {
+        m_transformations.push_back(t);
+    }
+
+
+    /* tags */
+    const Tags &getTags() const noexcept {
+        return m_tags;
+    }
+    void setTags(Tags tags) noexcept {
+        m_tags.insert(m_tags.end(), tags.begin(), tags.end());
+    }
+    void addTag(std::shared_ptr<Tag> t) {
+        m_tags.push_back(t);
+    }
+    bool hasTags() const noexcept {
+        return !m_tags.empty();
+    }
+    void clearTags() noexcept {
+        m_tags.clear();
+    }
+
+
+    /* vars */
+    const SetVars &getSetVars() const noexcept {
+        return m_setVars;
+    }
+    void addSetVar(std::shared_ptr<SetVar> t) {
+        m_setVars.push_back(t);
+    }
+
+
+    /* other match actions */
+    const MatchActions &getGenericMatchActions() const noexcept {
+        return m_executeIfMatchActions;
+    }
+    void addGenericMatchAction(std::shared_ptr<ActionWithExecution> a) {
+        m_executeIfMatchActions.push_back(a);
+    }
+
+
+    /* disruptive action */
+    const std::shared_ptr<ActionDisruptive> &getDisruptiveAction() const noexcept {
+        return m_disruptiveAction;
+    }
+    inline void setDisruptiveAction(std::shared_ptr<ActionDisruptive> d) noexcept {
+        m_disruptiveAction = d;
+    }
+    inline bool hasDisruptiveAction() const noexcept {
+        return m_disruptiveAction != nullptr;
+    }
+
+
+ private:
+    void inline copyActionsWithRunTimeStrings(const RuleWithActionsProperties &o);
+
+    /**
+     * FIXME: log, noLog, AuditLog and noAuditLog are save to compute whenver log
+     * is necessary or not. This can be pre-computed while the actions are
+     * encountered amoung the rule action list.
+     *
+     */
+    bool m_hasAuditLog:1;
+    bool m_hasBlock:1;
+    bool m_hasLog:1;
+    bool m_hasMultiMatch:1;
+    bool m_hasNoAuditLog:1;
+    bool m_hasNoLog:1;
+
+    MatchActions m_executeIfMatchActions;
+    SetVars m_setVars;
+    std::shared_ptr<ActionDisruptive> m_disruptiveAction;
+    Tags m_tags;
+    Transformations m_transformations;
+};
+
+}  // namespace modsecurity
+
+
+#endif  // SRC_RULE_WITH_ACTIONS_PROPERTIES_H_

src/rule_with_operator.cc

@@ -56,7 +56,7 @@ using actions::transformations::None;
 
 RuleWithOperator::RuleWithOperator(Operator *op,
     variables::Variables *_variables,
-    std::vector<Action *> *actions,
+    Actions *actions,
     Transformations *transformations,
     std::unique_ptr<std::string> fileName,
     int lineNumber)
@@ -217,7 +217,6 @@ bool RuleWithOperator::evaluate(Transaction *trans) const {
     bool globalRet = false;
     variables::Variables *variables = m_variables.get();
     bool recursiveGlobalRet;
-    bool containsBlock = hasBlockAction();
     std::string eparam;
     variables::Variables vars;
     vars.reserve(4);
@@ -303,7 +302,7 @@ bool RuleWithOperator::evaluate(Transaction *trans) const {
             executeTransformations(trans, value, transformationsResults);
 
             auto iter = transformationsResults.begin();
-            if (!hasMultimatchAction()) {
+            if (!processMultiMatch()) {
                 iter = transformationsResults.end();
                 std::advance(iter, -1);
             }
@@ -381,7 +380,7 @@ end_exec:
     /* last rule in the chain. */
     trans->logMatchLastRuleOnTheChain(this);
 
-    if (hasSeverityAction()) {
+    if (hasSeverity()) {
         ms_dbg_a(trans, 9, "This rule severity is: " + \
             std::to_string(getSeverity()) + " current transaction is: " + \
             std::to_string(trans->m_highestSeverityAction));

src/rule_with_operator.h

@@ -43,7 +43,7 @@ class RuleWithOperator : public RuleWithActions {
  public:
     RuleWithOperator(operators::Operator *op,
         variables::Variables *variables,
-        std::vector<actions::Action *> *actions,
+        Actions *actions,
         Transformations *transformations,
         std::unique_ptr<std::string> fileName,
         int lineNumber);

src/rules_set.cc

@@ -62,11 +62,11 @@ namespace modsecurity {
 
             RuleWithActions *nr = dynamic_cast<RuleWithActions *>(m_rules[i].get());
             nr->clearDefaultActions();
-            for (auto a : m_defaultActions) {
+            for (auto &a : m_defaultActions) {
                 nr->addDefaultAction(a);
             }
             for (auto a : m_defaultTransformations) {
-                nr->addDefaultTransformation(a);
+                nr->addDefaulTransformation(a);
             }
 
 

src/run_time_string.h

@@ -75,7 +75,7 @@ class RunTimeString {
     }
 
 
-    void populate(RuleWithActions *rule) noexcept {
+    void populate(const RuleWithActions *rule) noexcept {
         for (auto &a : m_elements) {
             a->populate(rule);
         }
@@ -108,7 +108,6 @@ class RunTimeString {
                     rv = dynamic_cast<RuleVariable *>(nrv);
                     rv->populate(nullptr);
                     m_variable = std::unique_ptr<Variable>(nrv);
-                    /* m_variable = nullptr; */
                 } else {
                     m_variable = other.m_variable;
                 }
@@ -119,7 +118,9 @@ class RunTimeString {
         void appendValueTo(const Transaction *transaction, std::string &v) const noexcept {
             if (m_variable && transaction) {
                 VariableValues l;
+
                 m_variable->evaluate(transaction, &l);
+
                 if (!l.empty()) {
                     v.append(l[0]->getValue());
                 }
@@ -130,19 +131,20 @@ class RunTimeString {
         }
     
 
-        void populate(RuleWithActions *rule) noexcept {
+        void populate(const RuleWithActions *rule) noexcept {
             if (!m_variable) {
                 return;
             }
 
             RuleVariable *vrule = dynamic_cast<RuleVariable *>(m_variable.get());
-            if (vrule != nullptr) {
+            if (!vrule) {
-                vrule->populate(rule);
+                return;
             }
+            vrule->populate(rule);
         }
 
      private:
-        std::string m_string;
+        const std::string m_string;
         /*
          *
          * FIXME: In the current state m_variable should be a unique_ptr. There

src/transaction.cc

@@ -72,14 +72,11 @@ void TransactionRuleMessageManagement::logMatchLastRuleOnTheChain(const RuleWith
 
     rm->setRule(rule);
 
-    if (rule->hasDisruptiveAction() && rule->isItToBeLogged() &&
+    if (rule->isItToBeLogged() &&
-        (m_transaction->getRuleEngineState() == RulesSet::DetectionOnlyRuleEngine)) {
+        (m_transaction->getRuleEngineState() == RulesSet::EnabledRuleEngine)) {
         /* error */
         // The error goes over the disruptive massage. We don't need it here.
         //m_transaction->serverLog(rm);
-    } else if (rule->hasBlockAction() && rule->isItToBeLogged()) {
-        /* Log as warning. */
-        m_transaction->serverLog(rm);
     } else if (rule->isItToBeLogged()) {
         /* Log as warning. */
         m_transaction->serverLog(rm);

src/transformation_result.h

@@ -0,0 +1,68 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include "modsecurity/modsecurity.h"
+#include "modsecurity/rule.h"
+#include "modsecurity/rule_message.h"
+#include "modsecurity/rules_set.h"
+
+#ifndef SRC_TRANSFORMATION_RESULT_H_
+#define SRC_TRANSFORMATION_RESULT_H_
+
+
+namespace modsecurity {
+
+
+class TransformationResult {
+ public:
+    explicit TransformationResult(
+        ModSecString &after,
+        const std::string *transformation = nullptr)
+        : m_after(after),
+        m_transformation(transformation) { };
+
+    explicit TransformationResult(
+        ModSecString *after)
+        : m_after(*after),
+        m_transformation(nullptr) { };
+
+    TransformationResult(const TransformationResult &t2)
+        : m_after(t2.m_after),
+        m_transformation(t2.m_transformation) { };
+
+
+    ModSecString *getAfter() {
+        return &m_after;
+    }
+
+
+    const std::string *getTransformationName() const {
+        return m_transformation;
+    }
+
+
+ private:
+    ModSecString m_after;
+    const std::string *m_transformation;
+};
+
+using TransformationsResults = std::list<TransformationResult>;
+
+}  // namespace modsecurity
+
+
+
+#endif  //  SRC_TRANSFORMATION_RESULT_H_
+

src/variables/rule.h

@@ -71,7 +71,7 @@ class Rule_DictElement : public RuleVariable, public VariableDictElement {
         const RuleWithActions *rule,
         VariableValues *l) {
 
-        if (rule->hasRevisionAction()) {
+        if (rule->hasRevision()) {
             auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_rev, std::unique_ptr<std::string>(new std::string(rule->getRevision())));
             VariableOrigin origin;
             origin.m_offset = 0;
@@ -87,7 +87,7 @@ class Rule_DictElement : public RuleVariable, public VariableDictElement {
         const RuleWithActions *rule,
         VariableValues *l) {
 
-        if (rule->hasSeverityAction()) {
+        if (rule->hasSeverity()) {
             auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_severity, std::unique_ptr<std::string>(new std::string(std::to_string(rule->getSeverity()))));
             VariableOrigin origin;
             origin.m_offset = 0;

src/variables/rule_variable.h

@@ -20,11 +20,11 @@
 #ifndef SRC_VARIABLES_RULE_VARIABLE_H_
 #define SRC_VARIABLES_RULE_VARIABLE_H_
 
-#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {
 
+class RuleWithActions;
 class Transaction;
 namespace variables {
 

src/variables/variable_with_runtime_string.h

@@ -40,7 +40,7 @@ class VariableWithRunTimeString : public Variable {
         return *this;
     }
 
-    virtual void populate(RuleWithActions *rule) {
+    virtual void populate(const RuleWithActions *rule) {
         if (m_string) {
             m_string->populate(rule);
         }

test/test-cases/regression/config-secdefaultaction.json

@@ -277,7 +277,13 @@
     },
     "rules":[
       "SecRuleEngine On",
-      "SecAuditEngine On",
+      "SecAuditEngine RelevantOnly",
+      "SecAuditLogParts ABCFHZ",
+      "SecAuditLog /tmp/test/modsec_audit_auditlog_1.log",
+      "SecAuditLogDirMode 0766",
+      "SecAuditLogFileMode 0666",
+      "SecAuditLogType Serial",
+      "SecAuditLogRelevantStatus \"^(?:3|4(?!04))\"",
       "SecDefaultAction \"phase:2,log,auditlog,status:302,redirect:'http://www.google.com'\"",
       "SecRule REQUEST_HEADERS \"@contains PHPSESSID\" \"phase:2,id:1,block\"",
       "SecRule TX \"@contains to_test\" \"id:2,t:lowercase,t:none,block\""

test/test-cases/regression/issue-1528.json

@@ -27,12 +27,13 @@
   },
   "expected": {
     "debug_log": "Rule returned 1",
-    "error_log": "Matched \"Operator `Rx' with parameter `\\^attack\\$'"
+    "error_log": "Matched \"Operator `Rx' with parameter `\\^attack\\$'",
+    "http_code": 403
   },
   "rules": [
     "SecRuleEngine On",
     "SecAction \"id:1, setvar:tx.bad_value=attack\"",
-    "SecRule ARGS:param \"@rx ^%{tx.bad_value}$\" \"id:2,log\""
+    "SecRule ARGS:param \"@rx ^%{tx.bad_value}$\" \"id:2,log,deny\""
   ]
 }
 ]

test/test-cases/regression/issue-1844.json

@@ -85,10 +85,12 @@
       ]
     },
     "expected":{
-      "error_log":"line \"55\""
+      "error_log":"line \"55\"",
+      "http_code": 403
     },
     "rules":[
       "SecRuleEngine On",
+      "SecDefaultAction \"phase:2,deny\"",
       "SecRule WEBAPPID \"@contains test2\" \"id:1,phase:3,pass,t:trim\"",
       "Include test-cases/data/big-file.conf"
     ]